On October 4, 2022, Sovryn's legacy Lend/Borrow pool was exploited via cross-contract reentrancy in closeWithDeposit. Attacker manipulated iToken price through fallback functions triggered by RBTC/rUSDT transfers, draining 44.9368 RBTC and 282,351.9644 rUSDT (~$1.1M).

Bitcoin DeFi application Sovryn tweeted that it found a vulnerability affecting the lending pool and was attacked. The attacker used the abandoned lending protocol to withdraw 44.93 RBTC and 211,045 USDT. After the developer detected the attack, the system entered maintenance mode. Half of the funds will be recovered, and any additional losses will be fully compensated by the treasury. A plan to restore system functions and provide post-mortem analysis will also be formulated in the future.